ci: skip Cloudflare deploy on Dependabot PRs

[rubenmarcus]

Problem

PRs #20–#25 (all Dependabot website-deps bumps) are blocked on the Deploy Docs to Cloudflare Pages check. Wrangler errors with:

In a non-interactive environment, it's necessary to set a CLOUDFLARE_API_TOKEN environment variable for wrangler to work.

Root cause: GitHub Actions blocks repository secrets from runs authored by `dependabot[bot]` as a security measure. So `secrets.CLOUDFLARE_API_TOKEN` is empty on those runs and the deploy step fails.

Fix

Skip the Deploy Preview and Comment Preview URL steps when `github.actor == 'dependabot[bot]'`. The Install and build step still runs, so we keep the sanity check that the dep bump actually compiles.

Why not pass the token via dependabot secrets?

Could work (`Settings → Secrets → Dependabot`), but it requires duplicating the secret and slightly broadens the trust surface for Dependabot. For a docs preview, it's not worth that — we don't need a per-PR preview from Dependabot bumps.

After this merges

The 6 stuck Dependabot PRs need to either:

• be rebased onto main (`@dependabot rebase` comment) so they pick up the new workflow, or
• be admin-merged now since we know they're safe (green Greptile / Vercel / Graphite, just dep bumps)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aeo-js	Ready	Preview, Comment	May 4, 2026 9:45am

[github-actions]

Docs Preview

Preview URL: https://chore-dependabot-skip-cf-dep.aeojs.pages.dev

This preview was deployed from the latest commit on this PR.

[greptile-apps]

Greptile Summary

Adds github.actor != 'dependabot[bot]' conditions to the Deploy Preview and Comment Preview URL steps so Dependabot PRs no longer fail on the missing CLOUDFLARE_API_TOKEN secret. The build step is intentionally left unguarded, preserving the compile sanity check on every dependency bump.

Confidence Score: 5/5

Safe to merge — a minimal, well-scoped CI fix with no logic or security concerns.

Both changed conditions are identical and correct: dependabot[bot] is the exact actor string GitHub uses, and skipping only the two secret-dependent steps while keeping the build step is the right approach. No other steps are affected and the pre-existing comment/deploy logic is unchanged.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/deploy-docs.yml	Adds github.actor != 'dependabot[bot]' guard to the Deploy Preview and Comment Preview URL steps so Dependabot PRs skip Cloudflare deploy while still running the build sanity check.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Workflow trigger] --> B{event_name?}
    B -->|push to main| C[Checkout + Build]
    B -->|pull_request| D[Checkout + Build]
    B -->|workflow_dispatch| E[Checkout + Build]

    C --> F[Deploy to Production]
    D --> G{actor == dependabot bot?}
    E --> H[No deploy steps match]

    G -->|Yes| I[Skip Deploy Preview\nSkip Comment Preview URL\n✅ Build ran as sanity check]
    G -->|No| J[Deploy Preview\nto Cloudflare Pages]
    J --> K[Comment Preview URL on PR]

Loading

_{Reviews (1): Last reviewed commit: "ci(deploy-docs): skip Cloudflare deploy ..." | Re-trigger Greptile}

[claude]

LGTM — straightforward CI fix to skip Cloudflare deploy steps on Dependabot PRs where repo secrets aren't available.

Extended reasoning...

Overview

This PR modifies a single GitHub Actions workflow (.github/workflows/deploy-docs.yml) to skip two steps (Deploy Preview and Comment Preview URL) when the PR is authored by dependabot[bot]. It adds an explanatory comment and tightens the existing if: conditions with && github.actor != 'dependabot[bot]'.

Security risks

None. If anything, this is the safer choice: Dependabot-authored runs already cannot read repository secrets by design, and the alternative (Dependabot secrets) would broaden the trust surface for a docs-preview convenience. The github.actor check is evaluated by the Actions runner and not user-controllable from a PR.

Level of scrutiny

Low — CI-only change, no production code paths affected. The Install and build sanity check still runs for Dependabot PRs, so we don't lose build-failure detection on dep bumps.

Other factors

The diff is two-line condition changes plus a comment, both following established Actions patterns. The root-cause analysis in the PR description matches the documented GitHub behavior. No bugs flagged by the bug hunting system.